Security Information and Event Management
Encyclopedia
Security Information and Event Management (SIEM) solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM (security event management). SIEM technology provides real-time analysis of security alerts generated by network hardware and applications.
SIEM solutions come as software, appliances or managed services, and are also used to log security data and generate reports for compliance purposes.
The acronyms SEM
, SIM
and SIEM have been used interchangeably, though there are differences in meaning and product capabilities. The segment of security management that deals with real-time monitoring, correlation of events, notifications and console views is commonly known as Security Event Management (SEM). The second area provides long-term storage, analysis and reporting of log data and is known as Security Information Management (SIM).
The term Security Information Event Management (SIEM), coined by Mark Nicolett and Amrit Williams of Gartner in 2005, describes the product capabilities of gathering, analyzing and presenting information from network and security devices; identity and access management applications; vulnerability
management and policy compliance tools; operating system, database and application logs; and external threat
data. A key focus is to monitor and help manage user and service privileges, directory services and other system configuration changes; as well as providing log auditing and review and incident response.
As of May 2011, Mosaic Security Research identified 98 unique SIEM products.
SIEM solutions come as software, appliances or managed services, and are also used to log security data and generate reports for compliance purposes.
The acronyms SEM
Security Event Manager
A security event manager is a computerized tool used on enterprise data networks to centralize the storage and interpretation of logs, or events, generated by other software running on the network....
, SIM
Security Information Management
Security information management is the industry-specific term in computer security referring to the collection of data into a central repository for trend analysis...
and SIEM have been used interchangeably, though there are differences in meaning and product capabilities. The segment of security management that deals with real-time monitoring, correlation of events, notifications and console views is commonly known as Security Event Management (SEM). The second area provides long-term storage, analysis and reporting of log data and is known as Security Information Management (SIM).
The term Security Information Event Management (SIEM), coined by Mark Nicolett and Amrit Williams of Gartner in 2005, describes the product capabilities of gathering, analyzing and presenting information from network and security devices; identity and access management applications; vulnerability
Vulnerability (computing)
In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance.Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw...
management and policy compliance tools; operating system, database and application logs; and external threat
Threat (computer)
In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and thus cause possible harm.A threat can be either "intentional" or "accidental" In Computer security a threat is a possible danger that might exploit a vulnerability to breach security and...
data. A key focus is to monitor and help manage user and service privileges, directory services and other system configuration changes; as well as providing log auditing and review and incident response.
As of May 2011, Mosaic Security Research identified 98 unique SIEM products.
SIEM Capabilities
- Data Aggregation: SIEM/LM (log management) solutions aggregate data from many sources, including network, security, servers, databases, applications, providing the ability to consolidate monitored data to help avoid missing crucial events.
- Correlation: looks for common attributes, and links events together into meaningful bundles. This technology provides the ability to perform a variety of correlation techniques to integrate different sources, in order to turn data into useful information.
- Alerting: the automated analysis of correlated events and production of alerts, to notify recipients of immediate issues.
- Dashboards: SIEM/LM tools take event data and turn it into informational charts to assist in seeing patterns, or identifying activity that is not forming a standard pattern.
- Compliance: SIEM applications can be employed to automate the gathering of compliance data, producing reports that adapt to existing security, governance and auditing processes.
- Retention: SIEM/SIM solutions employ long-term storage of historical data to facilitate correlation of data over time, and to provide the retention necessary for compliance requirements.
See also
- IT riskIT riskInformation technology risk, or IT risk, IT-related risk, is a risk related to information technology. This relatively new term due to an increasing awareness that information security is simply one facet of a multitude of risks that are relevant to IT and the real world processes it...
- Security event managerSecurity Event ManagerA security event manager is a computerized tool used on enterprise data networks to centralize the storage and interpretation of logs, or events, generated by other software running on the network....
- Security information managementSecurity Information ManagementSecurity information management is the industry-specific term in computer security referring to the collection of data into a central repository for trend analysis...
- Comparison of network monitoring systemsComparison of network monitoring systemsThis is a comparison of some notable network monitoring systems.- Legend :Product Name : The name of the software, linked to its Wikipedia article...